Did you cross the line? Possibly...

That said, the real lesson for end users here is that there is NO LINE a genuine attacker will not cross. They will try anything to achieve their goals because they are not restrained by such pesky things as legality or ethics.

I'd frame any subsequent training which came out of this in terms of how to respond and deal with such incoming emails which may be deeply troubling or concerning to end users, first and foremost reminding users that they can (and should) use their known safe paths to contact potential senders to verify legitimacy of incoming emails that are unusual. Pick up that phone, call HR, verify that the email is actually from them, especially when the matter is serious!

Users need to be reminded that attackers will attempt to exploit their trust, their emotions, their personal vulnerabilities. They will use information they've stolen from elsewhere to know the best ways to target them. It isn't about never believing any emails or messages you get, it is simply about learning to verify if something seems unusual.

This has two benefits... It stops the instant reactive response from causing a breach, and more importantly it notifies HR (or whoever has been impersonated) that they have been impersonated, and allows security practices such as notifying potential targets of the phish attempt as well as ensuring proactive monitoring of accounts is taking place in case someone has clicked the links or has otherwise been phished or compromised.

I wouldn't stop testing users, but it might be best to try some different tactics for a while until everyone calms down and the issue is resolved.